What are the types of VPN protocols and how do they differ?

The main VPN protocols are IPsec with IKEv2, WireGuard, OpenVPN, L2TP usually paired with IPsec, and the legacy PPTP. They differ in where they sit in the stack, how they agree on keys, how much code they involve and how old they are. For new deployments, the choice is usually among the first three.

What is IPsec with IKEv2?

IPsec is a framework of open standards, described by NIST SP 800-77 Rev. 1 as a widely used network layer security control. The architecture is in RFC 4301. It protects IP packets with ESP, and the tunnel mode wraps the whole original packet inside a new one. Configuration is usually done with the Internet Key Exchange protocol, with IKEv2 specified in RFC 7296 (October 2014).

Strengths: standardized, widely supported in operating systems and network gear, and suited to site to site links. Trade-off: a large set of options, so misconfiguration and weak parameter choices are real risks. NIST's guide spends considerable space on choosing parameters for this reason.

What is WireGuard?

WireGuard is a newer design with a deliberately small set of choices. Its protocol page lists fixed primitives: Curve25519 for key agreement, ChaCha20 with Poly1305 for encryption and authentication, and BLAKE2s for hashing. The handshake is based on the Noise framework, and all packets travel over UDP. There is no cipher negotiation, which removes a class of downgrade problems and makes the code easier to review.

Trade-off: a fixed design means you cannot swap in a different algorithm without a new protocol version. That connects to cryptographic agility, which we cover in a separate post.

What is OpenVPN?

OpenVPN is a long-running open source project that runs in user space and builds its secure channel on TLS. It is flexible, works over UDP or TCP, and is widely supported by clients. Flexibility means more configuration to get right. This summary comes from general knowledge of the project rather than a page fetched for this article, so check the project's current documentation before relying on details.

What are L2TP and PPTP?

L2TP is a tunneling protocol that provides no encryption by itself, so it is commonly combined with IPsec to protect the traffic. PPTP is older still: RFC 2637 dates from July 1999. Its age is a reason to avoid it in new designs and to plan migration for existing ones. Verify the current security guidance from your vendor and standards body before keeping it.

How do you compare them? A constructed example

A 40 person company has staff laptops that roam between Wi-Fi networks and one office firewall. The firewall supports IPsec and WireGuard. Staff on a mix of Windows, macOS and phones need a client. Because the firewall's IPsec support is certified for their compliance regime and managed by their provider, they choose IKEv2 for staff. For a small lab network that the engineering team manages, they choose WireGuard for its simplicity. PPTP, which a legacy printer vendor once required, is retired.

What criteria matter?

• Platform support for your devices and gateways.
• Whether your compliance rules require a particular validated implementation.
• Size and review history of the code involved.
• How keys and users are provisioned and revoked at scale.
• Behavior behind NAT and restrictive firewalls.
• Your ability to patch the gateway quickly.

How to check or apply this

1. List the devices and gateways that must be supported.
2. Check compliance requirements for approved cryptographic implementations.
3. Pick the protocol with the simplest configuration that meets those needs.
4. Disable old protocols and weak parameters on every gateway.
5. Plan how you will rotate keys and remove departed users.

Quick check

Sources

• NIST SP 800-77 Rev. 1, Guide to IPsec VPNs
• RFC 4301, Security Architecture for the Internet Protocol
• RFC 7296, Internet Key Exchange Protocol Version 2
• RFC 2637, Point-to-Point Tunneling Protocol
• WireGuard, Protocol and Cryptography

Last reviewed: 18 October 2026.